Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a legitimate Neon Auth helper, but it asks the agent to load or install another online skill before use, so it should be reviewed carefully.
Use this only if you intend to work with Neon Auth and you trust the Neon skill source. Before allowing the agent to fetch or install the parent neon skill, review or pin that content if possible. Watch for auth migrations, domain changes, deploys, and environment updates, and do not let it replace an existing identity provider unless that is your explicit goal.
The manifest description says to use the skill for phrases like "add auth" and especially "add login," which are generic requests that can arise in many contexts. The description provides examples but does not clearly bound when the skill should not activate beyond a few migration cases, increasing the chance of unintended invocation.
The skill instructs the agent to fetch or install a parent skill from an external URL/registry at runtime. This expands trust to additional unreviewed content and creates a skill-enumeration and supply-chain risk: an attacker who can influence that remote content, the installation source, or the resolution process could inject adversarial instructions into the agent workflow.
FIRST: Use the parent neon skill for a Neon overview, getting started with Neon, Neon development best practices, and more.
If the neon skill is not installed, fetch it from https://neon.com/docs/ai/skills/neon/SKILL.md or install it with:
neon skills -s neon -y
No suspicious patterns detected.